Skip to content
Zrico
Menu

For law firms

AI for Small Law Firms: What to Check Before You Buy

What a solo or 2 to 20 lawyer firm should check before buying AI: client confidentiality, data location, vendor access, citations, controls, price and exit.

Updated 6 min read

The right AI tool for a small law firm is one the firm controls, under business terms that do not train on client data, at a price the firm can see before it signs. Most solo and small firms choose between a general business plan, such as ChatGPT Business, Claude Team or Microsoft 365 Copilot, a legal platform such as Harvey, and a private AI workspace. This guide sets out what to check and how the options compare, from each vendor’s own pages as of October 2026.

Why does the choice matter for a small firm?

It matters because your ethics duties do not shrink with your headcount. ABA Formal Opinion 512 says that before you put information relating to a representation into a generative AI tool, you must assess the risk that people outside the firm could see it. It also says to read the tool’s terms and privacy policy, or rely on someone who has. A small firm rarely has an IT department to do that reading, so the questions below are meant to be worked through in an afternoon.

Does the vendor train on client data?

On a business plan, it should not. OpenAI, Anthropic and Microsoft each say their business products do not train models on your content by default, and Harvey says the same. Personal plans are different: OpenAI and Anthropic may use chats from personal accounts for training, depending on a setting. The first decision is to keep client work off personal accounts.

Also ask about feedback. Anthropic says that if you send feedback on a chat from a business plan, for example with a thumbs-up button, it may use that chat for training. Tell staff not to rate client conversations.

Where is client data processed?

It depends on the vendor, and sometimes on the model. Microsoft says that outside the EU, Copilot requests may be processed in the US, the EU or other regions. OpenAI offers data residency to some Enterprise, Edu and API customers, but does not list ChatGPT Business. Harvey offers in-region hosting in the US, the EU and Switzerland, or Australia. If a client or a protective order requires US processing, get the answer in writing.

Who at the vendor can see your data?

Ask each vendor for its staff-access policy, in writing. OpenAI says its people can view stored ChatGPT Business conversations only for engineering support, investigating possible abuse and legal compliance, and that specialized contractors may review content for abuse. Opinion 512 applies the supervision rules to outside providers, and suggests checking that the vendor’s confidentiality obligation is enforceable and that you will be told about a breach or a demand for client data.

How does the tool handle citations?

Every AI model can invent a case, misquote a statute or cite law that is no longer good. Courts have sanctioned lawyers for filing fake citations, and Opinion 512 says lawyers must review AI output, including citations, before submitting it to a court. Ask each vendor whether its tool checks citations against real sources, which sources, and what it does when it cannot find one. Then check every citation yourself anyway. Our guide to AI hallucinated citations sets out a routine.

Can a partner see and control how the firm uses AI?

The partners who run the firm should be able to. Opinion 512 says lawyers with managerial authority must set clear policies on permitted AI use and make reasonable efforts to see they are followed. That is easier when an owner can see who used AI and when, set retention, and decide which models and features are on.

The vendors differ here. OpenAI lists admin-set retention and usage analytics for ChatGPT Business, with audit logs through its Compliance API listed for Enterprise. Anthropic lists audit logs and custom retention for Claude Enterprise, not Team. Harvey lists audit logs and customer-set retention. Microsoft manages Copilot records through Microsoft Purview.

What does it cost, and is there a minimum?

Published prices vary, and some are not published at all. As of October 2026:

Published price, per user a month Minimum
ChatGPT Business (Standard seat) $20 billed annually, $25 monthly 2 seats
Claude Team (Standard seat) $20 billed annually, $25 monthly 2 seats (teams of 2 to 150)
Microsoft 365 Copilot Business $21 billed annually ($18 promotional through the end of 2026), $25.20 monthly, on top of a qualifying Microsoft 365 plan None stated
Harvey Not published. Demo on request Not published
Zrico $39 a seat, AI usage included and pooled across the firm 5 seats

If your firm already uses practice-management software, ask what AI it includes. Clio, for example, says AI comes as part of its Core plan and above rather than as a separate add-on, and that your data will never be used to train external models. Its pricing page lists plans starting at $49 per user.

Ask for the contract term too. A low monthly price with an annual commitment is still an annual commitment.

Can you leave and take your data with you?

You should be able to, and you should find out how before you sign. Ask whether an owner can export chats, files and logs, in what format, how long you have after cancelling, and when deleted data leaves backups.

What independent audits does the vendor have?

Some clients send security questionnaires that ask for a SOC 2 report. OpenAI reports SOC 2 Type 2 for ChatGPT Business. Anthropic lists SOC 2 Type I and Type II, ISO 27001 and ISO 42001 for its commercial products. Microsoft lists ISO 27001 and ISO 42001 among others. Harvey lists SOC 2 Type II, ISO 27001, ISO 27701 and ISO 42001. Zrico has none. If your clients require a report, that settles part of the decision.

Which option fits which firm?

  • ChatGPT Business or Claude Team: a firm that wants a general assistant from the model maker at a low per-seat price, and will set its own rules for use.
  • Microsoft 365 Copilot: a firm that runs on Microsoft 365 and wants AI in Outlook, Word and Teams. Tidy your SharePoint and Teams permissions first, because Copilot can see what each user can open.
  • Harvey: a firm that wants a legal-specific platform with independent audits and in-region hosting, and is ready for a sales-led rollout.
  • A private AI workspace: a firm that wants its own separate workspace, legal assistants ready to use, and partner controls. See What is a private AI workspace?

For a side-by-side table with sources, see Compare. For the full list of questions to send a vendor, use our due-diligence checklist.

How Zrico fits

Zrico gives each firm its own application and databases. Claude is the default and is processed in the US. GPT and Gemini are off until the owner turns them on, and their processing is not limited to the US. The providers’ business APIs do not train on customer data. The owner gets a usage and audit log and retention settings, and can get an export of the firm’s chats, files and audit log, including for 30 days after cancelling. Zrico is $39 per seat per month with a 5-seat minimum and a 30-day free trial, with AI usage included and pooled across the firm. Zrico Pro, at $89 per seat per month for everyone in the firm, adds cite-check and other legal tools and is in early access, by request. Zrico has no SOC 2, ISO or HIPAA certification, and a lawyer must review its output. See pricing and security.

Sources

ChatGPT, Claude, Microsoft 365 Copilot, Harvey and Clio are trademarks of their owners; Zrico is not affiliated with them. Vendors change prices and plans often, so check their current pages.

General information, not legal advice.

Give your firm a private place to use AI.

$39 per seat per month after a 30-day free trial, 5-seat minimum. Your workspace is ready minutes after you sign up.

Your card is charged when the trial ends. Cancel any time before then and you pay nothing.

Start 30-day free trial